CVE-2021-3020: High severity clusterlabs vulnerability
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawkinvoke (built from tools/hawkinvoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawkinvoke, allowing escalation to root.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-3020.
What is the severity of CVE-2021-3020?
The severity of CVE-2021-3020 is high with a CVSS score of 8.8.
What software is affected by CVE-2021-3020?
ClusterLabs Hawk versions up to and including 2.3.0-15 are affected by this vulnerability.
How can the hacluster user exploit CVE-2021-3020?
The hacluster user can exploit CVE-2021-3020 to invoke certain commands as root.
Are there any fixes or patches available for CVE-2021-3020?
Yes, fixes and patches are available. Please refer to the references for more information.